Answer (1)

This would appear that the loadbalancer is closing the connection.
The 2008+ all use im_msvistalog with no differences, and the binary for install is the same.
The om_tcp is the same as well. There should be no reason on the NXLog side that the connections would be viewed as different.
On the network side, do the servers take the same path to get to the Syslog server? I would investigate why the Loadbalancer is closing the connection and move from there.